Filter Workers' public Internet traffic using Gateway policies

Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway. This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today.

1. Worker Calls env.EGRESS.fetch()
2. VPC binding↓
3. Cloudflare Mesh Bind via cf1:network
4. ↓
5. Cloudflare Gateway Policies applied: DNSHTTPNetwork
6. ↓
7. ↗Public Internet Any public hostname or IP

Gateway logsDNSHTTPNetwork

What you get by default:

• Visibility. Worker egress shows up in Gateway DNS, HTTP, and Network logs alongside your other traffic, so you can audit what your Workers are calling and when.
• Enforcement. Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block.

{ "vpc_networks": [ { "binding": "EGRESS", "network_id": "cf1:network", "remote": true, }, ], }

[[vpc_networks]] binding = "EGRESS" network_id = "cf1:network" remote = true

// Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://api.example.com/data");

// Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://api.example.com/data");

For configuration options, refer to VPC Networks. For policy authoring, refer to Cloudflare Gateway traffic policies.